[SIEM] Threat hunting enhancements: Filter for/out value, Show top field, Copy to Clipboard, Draggable chart legends#61207
Merged
andrew-goldstein merged 2 commits intoelastic:masterfrom Apr 17, 2020
Conversation
Contributor
|
Pinging @elastic/siem (Team:SIEM) |
XavierM
approved these changes
Mar 25, 2020
37e2ca9 to
531185b
Compare
504fd77 to
bfa5400
Compare
bfa5400 to
511f797
Compare
19b11bb to
9b9cac9
Compare
9b9cac9 to
6174893
Compare
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/charts/barchart.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/drag_and_drop/draggable_wrapper.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/drag_and_drop/helpers.ts
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/drag_and_drop/helpers.ts
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/header_section/index.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/matrix_histogram/index.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/matrix_histogram/index.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/matrix_histogram/index.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/timeline/query_bar/index.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
x-pack/legacy/plugins/siem/public/components/timeline/timeline.tsx
Outdated
Show resolved
Hide resolved
XavierM
reviewed
Apr 15, 2020
XavierM
reviewed
Apr 15, 2020
...gacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/index.tsx
Outdated
Show resolved
Hide resolved
XavierM
approved these changes
Apr 15, 2020
Contributor
XavierM
left a comment
There was a problem hiding this comment.
Still LGTM ;) 🚀 💪 🚀Thank you for all the good test
6174893 to
ed082f7
Compare
 A new context menu with the following items has been added to all draggables: - Filter for value - Filter out value - Show top _field name_ - Copy to Clipboard as shown in the following animated gif:  The _Filter for value_ context menu action adds the draggable to the global filter bar, which is applicable to all pages in the SIEM app, per the following animated gif:  The _Filter out value_ context menu action adds the draggable to the global filter bar as a _negated_ (`NOT`) filter, per the following animated gif:  The _Show top field_ context menu action displays an interactive Top 10 histogram, per the following animated gif:  - The contents of the histogram are filtered by the global KQL bar / filters and current date range - Brushing over the bars in the histogram updates the global date range / picker - Select _Events_ or _Signals_ - The _Show top field_ action is also available in the Fields Browser, per the following animated gif:  The _Copy to clipboard_ context menu action copies the draggable field and value to the clipboard in KQL format (e.g. `process.name: "nice"`). Per the following animated gifs, it's now possible to copy _any_ draggable to the clipboard, and paste it in KQL format, which addresses [this feature request from a user](elastic#59472):   You may now pivot from chart legends by dragging and dropping them to a timeline, or by selecting the Filter for / out context menu action, per the following animated gif:  Desk tested in: - Chrome `81.0.4044.92` - Firefox `75.0` - Safari `13.1`
ed082f7 to
ba34f6d
Compare
Contributor
💚 Build SucceededHistory
To update your PR or re-run it, just comment with: |
andrew-goldstein
added a commit
that referenced
this pull request
Apr 17, 2020
…eld, Copy to Clipboard, Draggable chart legends (#61207) (#63816) ## [SIEM] Threat hunting enhancements: Filter for/out value, Show top field, Copy to Clipboard, Draggable chart legends Enhancements to the threat hunting experience  ### New draggable context menu A new context menu with the following items has been added to all draggables: - Filter for value - Filter out value - Show top _field name_ - Copy to Clipboard as shown in the following animated gif:  ### Filter for value The _Filter for value_ context menu action adds the draggable to the global filter bar, which is applicable to all pages in the SIEM app, per the following animated gif:  ### Filter out value The _Filter out value_ context menu action adds the draggable to the global filter bar as a _negated_ (`NOT`) filter, per the following animated gif:  ### Show top _field_ The _Show top field_ context menu action displays an interactive Top 10 histogram, per the following animated gif:  - The contents of the histogram are filtered by the global KQL bar / filters and current date range - Brushing over the bars in the histogram updates the global date range / picker - Select _Events_ or _Signals_ - The _Show top field_ action is also available in the Fields Browser, per the following animated gif:  ### Copy to Clipboard The _Copy to clipboard_ context menu action copies the draggable field and value to the clipboard in KQL format (e.g. `process.name: "nice"`). Per the following animated gifs, it's now possible to copy _any_ draggable to the clipboard, and paste it in KQL format, which addresses [this feature request from a user](#59472):   ### Draggable chart legends You may now pivot from chart legends by dragging and dropping them to a timeline, or by selecting the Filter for / out context menu action, per the following animated gif:  #### Desk testing Desk tested in: - Chrome `81.0.4044.92` - Firefox `75.0` - Safari `13.1`
gmmorris
added a commit
to gmmorris/kibana
that referenced
this pull request
Apr 17, 2020
* master: (40 commits) [APM]Upgrade apm-rum agent to latest version to fix full page reload (elastic#63723) add deprecation warning for legacy 3rd party plugins (elastic#62401) Migrate timelion vis (elastic#62819) Replacebad scope link with actual values (elastic#63444) Index pattern management UI -> TypeScript and New Platform Ready (create_index_pattern_wizard) (elastic#63111) [SIEM] Threat hunting enhancements: Filter for/out value, Show top field, Copy to Clipboard, Draggable chart legends (elastic#61207) [Maps] fix term join agg key collision (elastic#63324) [Ingest] Fix agent config key sorting (elastic#63488) [Monitoring] Fixed server response errors (elastic#63181) update elastic charts to 18.3.0 (elastic#63732) Start services (elastic#63720) [APM] Encode spaces when creating ML job (elastic#63683) Uptime 7.7 docs (elastic#62228) [DOCS] Updates remote cluster and ccr docs (elastic#63517) [Maps] Add 3rd party vector tile support (elastic#62084) [Endpoint][EPM] Retrieve Index Pattern from Ingest Manager (elastic#63016) [Endpoint] Host Details Policy Response Panel (elastic#63518) [Uptime] Certificate expiration threshold settings (elastic#63682) Refactor saved object types to use `namespaceType` (elastic#63217) [SIEM][CASE] Create comments sequentially (elastic#63692) ...
1 task
Contributor
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[SIEM] Threat hunting enhancements: Filter for/out value, Show top field, Copy to Clipboard, Draggable chart legends
Enhancements to the threat hunting experience
New draggable context menu
A new context menu with the following items has been added to all draggables:
as shown in the following animated gif:
Filter for value
The Filter for value context menu action adds the draggable to the global filter bar, which is applicable to all pages in the SIEM app, per the following animated gif:
Filter out value
The Filter out value context menu action adds the draggable to the global filter bar as a negated (
NOT) filter, per the following animated gif:Show top field
The Show top field context menu action displays an interactive Top 10 histogram, per the following animated gif:
Copy to Clipboard
The Copy to clipboard context menu action copies the draggable field and value to the clipboard in KQL format (e.g.
process.name: "nice").Per the following animated gifs, it's now possible to copy any draggable to the clipboard, and paste it in KQL format, which addresses this feature request from a user:
Draggable chart legends
You may now pivot from chart legends by dragging and dropping them to a timeline, or by selecting the Filter for / out context menu action, per the following animated gif:
Desk testing
Desk tested in:
81.0.4044.9275.013.1